Cybersecurity serious game : why e-learning is no longer enough

A French bank's SRI told me last year that his biggest frustration was not the budget - it was the Total disengagement of its employees in the face of cyber training modules. "We tried everything: videos, quizzes, phishing simulations. Everyone clicks to validate, nobody holds back." His first session of serious cyber game, organized in physics with 60 people, changed his video calln. "For the first time in three years, they were talking cybersecurity at lunch."

The physical format changes everything, but you have to design it properly. A bad serious game is worse than a good e-learning: it discredits the subject and demobilizes the teams for months.

Why the serious game changes the game into cyber

According to ANSSI, 80% of successful cyber attacks exploit human error (phishing, low password, poor data management). Classic cybersecurity e-learning has a low engagement rate (15 to 25%) and poor retention. serious game cybersecurity well designed reverses these ratios: commitment from 70 to 90%, retention multiplied by 3, behaviour modified sustainably.

DSI and RSSI now integrate serious game into their annual awareness-raising system, in addition to simulated phishing and mandatory e-learning modules.

Effective Cyber Security Formats

Three formats work for a serious game cybersecurityThe "network defense" card game: 80 cards representing threats (phishing, ransomware, social engineering) and defenses (MFA, VPN, password management), to be played in teams. The "secure co-workers' path" board: 6 to 8 players pass a typical day with choice of behavior (click or not, open or share or not). The cybersecurity escape game: teams solve a simulated attack in 60 minutes.

The choice depends on the audience and the context: cards for short sessions in teams, tray for workshops of 1h30, escape game for events managers or tech.

Content and compliance

The content of a serious game cybersecurity must cover the 10 priority themes of ANSSI: passwords, phishing, web browsing, e-mail, USB and removable media, mobile and BYOD, telework, personal data, social engineering, incident reporting. For a technical audience (DSI, RSSI, IT teams), the attack chain MITRE ATT&CK and the EDR/SIEM mechanisms are deepened.

Craft Your Games works with cybersecurity experts to validate content before printing. Our form specify your priority themes.

3 mistakes to avoid

1. Content too technical : a serious game for all employees must remain accessible to non-IT. Reserve the technique to specialized teams.
2. No animation : The game without animator trained in cyber loses 50% of its educational impact.
3. Ignore Update Threats are changing. Provide for an annual update of cards or usage cases.

Costs and MOQ : what we don't tell you in the initial quote

The initial quote for a project serious game cybersecurity almost always hides three variables that tilt the final budget. First variable: the actual MOQ per component. A manufacturer can display an overall MOQ, but impose distinct minimums per sub-element (specific cards, soft-touch lamination, printed wooden tokens). The quote announced in overall MOQ is therefore rarely the actual quote on arrival - hence the importance of requiring a breakdown by component to assess the consistency of the costing.

Second variable: the cost of tooling dies and plates. For an offset series, the plates represent an initial investment amortized over the quantity. On small series, this tooling cost is mechanically heavier per unit - which can transform the perception of the displayed unit price. Any serious quote distinguishes the material cost, the tool cost and the labor cost. If your quote shows a single unit price without breakdown, ask for it systematically.

Third variable: post-production logistics cost. Individual cellophane, placed in master carton, palletizing, labeling, multi-site transport, insurance: these lines are regularly forgotten in the first costing. For B2B projects delivered on several French sites (typical scenario of a large group distributing its serious game cybersecurity to several regional branches), require a costed logistics simulation before signing. This precaution avoids the surprise of a final invoice higher than expected.

On the MOQ side, several economic levels structure the market: a small volume for a test project (high unit cost but controlled investment), an intermediate volume for an initial deployment (declining unit cost), a large volume for a large deployment (optimized cost), a very large volume for a multi-year strategic project (floor cost). Choosing the right level involves balancing commercial risk and economies of scale - the classic error is to aim between two levels and pay the unit cost of a small series without benefiting from a real economy of scale. For a quote tailored to your real needs, our team will get back to you within 48 hours.

The 5 classic traps to avoid on a serious cybersecurity game project

Of the hundreds of projects serious game cybersecurity that we have supported since 2018, five errors recur more often than the others. Identifying them allows you to save several weeks on the project schedule and better control the budget. Here is the list, in order of observed frequency.

Pitfall #1: briefing the manufacturer too early. Before contacting the manufacturer, four internal decisions must be made: precise target audience, context of use (meeting, trade show, kit sent), expected behavior, internal validation circuit. Without these four decisions, any quote is arbitrary - therefore useless. This error systematically generates several commercial round trips and several lost calendar weeks.

Trap #2: underestimate the internal validation time. The period announced by the manufacturer generally starts after validation of the Good to Shoot. However, the validation of the BAT (Good to Print, validation before printing) often takes more time than expected on the client side: back and forth graphics, legal validation for packaging, internal compliance verification. Anticipate this validation time in your back-planning.

Trap #3: not testing the prototype in real conditions. A prototype validated "in the office" can reveal critical defects in use conditions (room light, attention span, multi-player context). A structured test session with testers representative of the final public reveals the majority of critical defects before series production.

Trap #4: neglecting the post-manufacturing phase. Packaging, kitting, storage, split shipping: these steps represent a significant portion of the total budget but are often forgotten in the first estimates. Frame them from the initial brief to avoid unpleasant surprises at the time of delivery.

Trap #5: underinvesting in the creative brief. A creative briefing rich in visual references and textual details massively reduces the number of back and forths in the model phase. A vague brief mechanically generates significant readjustment costs and a schedule that slips. Invest time in the brief before launching manufacturing - this is the best ROI on a project. serious game cybersecurity.